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March  5,  1996 

MEMORANDUM  FOR  ASSISTANT  SECRETARY  OF  DEFENSE  (COMMAND, 

CONTROL,  COMMUNICATIONS,  AND  INTELLIGENCE) 

SUBJECT:  Audit  Report  on  Acquisition  of  Computers  That  Process  Corporate 
Information  (Report  No.  96-081) 


We  are  providing  this  audit  report  for  your  information  and  use.  We  considered 
management  comments  on  a  draft  of  this  report  in  preparing  the  final  report. 

As  a  result  of  management  comments  and  additional  audit  work,  we  deleted  a 
draft  report  recommendation  to  revise  DoD  information  infrastructure  policy  to  include 
management  of  midtier  computers  that  process  corporate  information  because  Office  of 
Management  and  Budget  Bulletin  96-02,  "Consolidation  of  Agency  Data  Centers," 
should  correct  that  issue.  Management  comments  on  the  finding  and  remaining 
recommendation  conformed  to  the  requirements  of  DoD  Directive  7650.3  and  left  no 
unresolved  issues.  Therefore,  additional  comments  are  not  required. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Ms.  Mary  Lu  Ugone,  Audit  Program  Director,  at  (703)  604-9529 
(DSN  664-9529)  or  Ms.  Cecelia  A.  Miggins,  Audit  Project  Manager,  at 
(703)  604-9542  (DSN  664-9542).  See  Appendix  F  for  the  report  distribution.  The 
audit  team  members  are  listed  inside  the  back  cover. 


Assistant  Inspector  General 
for  Auditing 


Robert  J.  Lieberman 


Office  of  the  Inspector  General,  DoD 


Report  No.  96-081  March  5, 1996 

(Project  No.  5RE-0035) 

Acquisition  of  Computers  That  Process 
Corporate  Information 

Executive  Summary 

Introduction.  The  Secretary  of  Defense  announced  the  Corporate  Information 
Management  initiative  on  November  16,  1990,  to  establish  a  DoD-wide  concept  for 
managing  computer,  communications,  and  information  management  functions. 
Subsequently,  the  Deputy  Secretary  of  Defense  signed  Defense  Management  Report 
Decision  918,  "Defense  Information  Infrastructure,"  on  September  15,  1992,  to 
provide  policy  for  the  management  of  the  computers  and  communications  networks  that 
process  corporate  information.  In  addition,  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence)  issued  a  memorandum  on 
June  23,  1994,  that  established  the  Technical  Architecture  Framework  for  Information 
Management  as  the  single  source  of  guidance  for  the  integration  of  DoD  information 
systems. 

On  October  13,  1993,  the  Deputy  Secretary  of  Defense  directed  the  Principal  Staff 
Assistants  to  select  standard,  DoD-wide  systems  to  process  corporate  information.  As 
part  of  the  development  process  for  the  standard  systems,  DoD  program  managers  are 
acquiring  computers  to  support  their  information  processing  requirements. 

Objective.  The  audit  objective  was  to  determine  whether  the  acquisition  of  automatic 
data  processing  equipment  is  consistent  with  the  intent  of  the  Corporate  Information 
Management  initiative  as  it  relates  to  streamlining  the  Defense  information 
infrastructure.  We  also  reviewed  the  management  control  program  as  it  applied  to  the 
primary  audit  objective. 

Audit  Results.  The  DoD  Components  did  not  sufficiently  coordinate  the  acquisition 
and  management  of  computers  that  process  corporate  information  because  the 
requirements  of  Defense  Management  Report  Decision  918,  "Defense  Information 
Infrastructure,"  which  focused  on  mainframe  computers,  have  not  been  integrated  with 
the  standards  of  the  Technical  Architecture  Framework  for  Information  Management, 
to  include  midtier  (minicomputer)  computers.  As  a  result,  planned  acquisitions  of 
midtier  computer  equipment,  costing  $200  million,  may  result  in  excess  computer 
processing  capabilities.  In  addition,  the  audit  identified  a  management  control 
weakness  in  that  there  is  a  gap  in  policy  for  the  acquisition  and  management  of 
computers  that  process  corporate  information  (Appendix  A). 

Policy  changes  that  result  from  Office  of  Management  and  Budget  Bulletin  96-02, 
"Consolidation  of  Agency  Data  Centers,"  October  4,  1995,  and  the  recommendation  in 
the  report,  if  implemented,  will  ensure  that  DoD  has  a  comprehensive  policy  for 
managing  its  information  infrastructure  and  will  correct  the  management  control 
weakness.  See  Part  I  for  a  discussion  of  the  audit  results  and  Appendix  D  for  a 
summary  of  the  potential  benefits  resulting  from  the  audit. 

Summary  of  Recommendations.  We  recommend  establishment  of  procedures  for 
evaluating  and  providing  corporate  information  processing  and  storage  requirements  on 
a  DoD-wide  basis. 


Management  Comments.  The  Deputy  Assistant  Secretary  of  Defense  (Information 
Management)  concurred  and  stated  that  implementation  of  Office  of  Management  and 
Budget  Bulletin  96-02,  "Consolidation  of  Agency  Data  Centers,"  provides  a  sound 
foundation  for  better  computer  capacity  planning  and  DoD-wide  data  sharing. 

Audit  Response.  Management  comments  were  responsive.  We  deleted  the 
recommendation  to  revise  information  infrastructure  policy  to  include  management  of 
midtier  computers  because  the  implementation  of  Office  of  Management  and  Budget 
Bulletin  96-02  should  correct  this  issue. 
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Audit  Results 


Audit  Background 


Corporate  Information  Management  Initiative.  On  November  16,  1990,  the 
Secretary  of  Defense  assigned  responsibility  for  implementing  the  Corporate 
Information  Management  (CIM)  initiative  to  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence).  The  purpose  of  the 
CIM  initiative  is  to  establish  a  conceptual  framework  for  the  management  of 
DoD  computer,  communication,  and  information  management  functions.  The 
CIM  initiative  has  four  goals:  common  information  systems;  shared,  standard 
data;  reengineered  processes;  and  a  computer  and  communications 
infrastructure.  To  implement  CIM,  senior  DoD  managers  have  issued  Defense 
Management  Report  Decision  918,  the  Technical  Architecture  Framework  for 
Information  Management,  and  the  DoD  Strategic  Plan. 

Defense  Management  Report  Decision  918.  On  September  15,  1992,  the 
Deputy  Secretary  of  Defense  signed  the  Defense  Management  Report 
Decision  918,  "Defense  Information  Infrastructure,"  to  improve  information 
management  capability  in  DoD.  Decision  918  supports  the  information 
management  goal  of  providing  a  centralized  computer  and  communications 
infrastructure  for  mainframe  processing.  DoD  information  management  policy 
is  in  DoD  Directive  8000.1,  "Defense  Information  Management  Program," 
October  27,  1992. 

Technical  Architecture  Framework  for  Information  Management.  On 
June  23,  1994,  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  a  memorandum  that  established  the 
Technical  Architecture  Framework  for  Information  Management  as  the  single 
guide  for  the  integration  of  DoD  information  systems.  The  guide  defines 
common  services,  standards,  and  configurations,  including  support  applications, 
computer  platforms,  and  communications  networks  for  the  DoD  information 
infrastructure. 

Strategic  Plans  and  Implementing  Directives.  The  Deputy  Secretary  of 
Defense  approved  the  DoD  Strategic  Plan,  "Corporate  Information  Management 
for  the  21st  Century,"  on  June  13,  1994.  The  Strategic  Plan  expands  CIM 
planning  to  include  plans  for  the  Principal  Staff  Assistants  and  DoD 
Components.  The  Strategic  Plan  also  serves  as  the  basis  for  issuing  DoD  policy 
and  directives  on  information  management. 

DoD  Directive  8120.1,  "Life-Cycle  Management  of  Automated  Information 
Systems,"  January  14,  1993,  states  that  it  is  DoD  policy  for  program  managers 
to  develop  automated  information  systems  in  accordance  with  strategic  plans. 
The  Directive  aids  DoD  Component  program  managers  in  developing 
standardized  systems. 
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Audit  Results 


Audit  Objectives 


The  primary  audit  objective  was  to  determine  whether  the  acquisition  of 
automatic  data  processing  equipment  was  consistent  with  the  intent  of  the 
Corporate  Information  Management  initiative  as  it  related  to  streamlining  the 
Defense  information  infrastructure.  We  also  reviewed  the  Assistant  Secretary  of 
Defense  (Command,  Control,  Communication,  and  Intelligence)  management 
control  program  as  it  applied  to  the  primary  audit  objective.  See  Appendix  A 
for  a  discussion  of  the  audit  scope  and  methodology  and  the  review  of  the 
management  control  program,  and  see  Appendix  B  for  a  summary  of  prior 
coverage  related  to  die  audit  objectives.  Appendix  C  discusses  the  central 
design  activities  and  the  effect  that  the  management  and  control  of  those 
organizations  have  on  streamlining  the  Defense  information  infrastructure. 
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Acquisition  and  Management  of 
Computers  That  Process  Corporate 
Information 

The  DoD  Components  did  not  sufficiently  coordinate  their  acquisition 
and  management  of  computers  that  process  corporate  information  to 
ensure  effective  and  efficient  DoD-wide  use  of  computer  resources. 
Coordinated  acquisition  and  management  were  not  achieved  because 
requirements  stated  in  Defense  Management  Report  Decision  918,  which 
focused  on  mainframe  computers,  have  not  been  integrated  with  the 
standards  of  the  Technical  Architecture  Framework  for  Information 
Management  to  address  midtier1  computer  processing.  As  a  result,  the 
DoD  Component's  planned  acquisitions  of  midtier  computer  equipment, 
costing  about  $200  million,  may  result  in  excess  processing  capabilities 
within  the  DoD. 


DoD  Policy  and  the  Standards  for  Information  Infrastructure 
Design 


Infrastructure  Policy  and  Standards.  The  Defense  information  infrastructure 
is  intended  to  be  a  seamless  web  of  communications,  networks,  computers, 
software,  applications,  and  corporate  data  that  support  DoD  information 
processing  requirements.  However,  the  policy  on  acquiring  and  managing  the 
proper  mix  of  mainframe  and  midtier  computers  to  process  corporate  data  is 
incomplete.  Management  policy  in  Defense  Management  Report  Decision  918 
has  not  been  applied  to  midtier  computers  that  process  corporate  data,  but 
midtier  computers  are  and  will  continue  to  be  a  key  component  in  the  DoD 
information  infrastructure.  The  need  for  clear  policy  and  procedures  for  the 
acquisition  and  management  of  midtier  computers  is  especially  critical,  because 
those  computers  are  becoming  the  program  manager's  most  frequent  solution 
for  complying  with  DoD  requirements  for  developing  computer  systems. 
Further,  as  die  DoD  information  infrastructure  expands  with  midtier  computer 
processing  capabilities,  the  potential  for  excess  processing  capabilities  in  DoD 
increases,  unless  policy  and  procedures  for  acquiring  and  managing  both 
mainframe  and  midtier  computers  are  established. 

Defense  Management  Report  Decision  918.  The  Defense  Management  Report 
Decision  918  requires  DoD  to  manage  and  control  corporate  information 
processing  systems.  Decision  918  states  in  part: 


iAlso  known  as  a  midrange  computer  or  a  minicomputer,  a  midtier  computer  is 
a  medium-scale  computer  that  functions  as  a  multi-user  system  with  several 
hundred  terminals. 
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...  the  DISA  [Defense  Information  Systems  Agency]  becomes  central 
manager  of  the  defense  information  infrastructure  which  is  defined  as 
all  DoD  communications  support  networks  requiring  systems 
integration,  e.g.  [for  example],  interfaces  with  defense 
communications  systems,  including  local  access  switches,  network 
control  centers,  central  data  processing  operations,  and  software 
development  for  all  applications  managed  under  the  Corporate 
Information  Management  initiative. 

Defense  Management  Report  Decision  918  also  states  that  the  Defense 
Information  Systems  Agency  responsibilities  include  development  and 
enforcement  of  information  technology  standards,  management  of  data 
processing  installations,  and  consolidation  of  all  data  processing  installations 
into  a  small  number  of  megacenters.  Defense  Management  Report 
Decision  918  specifically  excludes  information  processing  functions  and 
facilities  associated  with  strategic  and  tactical  command,  control,  and 
intelligence.  As  of  September  30,  1994,  the  reported  acquisition  value  of 
megacenter  computer  assets  totaled  $891.5  million/ 

Technical  Architecture  Framework  for  Information  Management.  The 
guidance  and  standards  in  the  Technical  Architecture  Framework  for 
Information  Management  are  "the  glue"  of  the  open  systems  architecture.  The 
phrase  "open  systems"  describes  computer  applications  that  can  communicate 
with  each  other  across  a  network  and  across  computer  applications  that  use  a 
common  operating  system  interface.  The  Technical  Architecture  Framework 
for  Information  Management  defines  open  systems  as  those  that  permit 
computer  applications  software  to  operate  on  a  wide  range  of  computer 
equipment.  The  Technical  Architecture  Framework  for  Information 
Management  does  not  require  a  specific  architecture,  hardware  solution,  or 
operating  system.  However,  the  UNIX3  computer  operating  system  has  become 
the  basis  for  defining  open  systems  standards,  and  the  primary  computer 
equipment  for  UNIX  computer  applications  is  the  minicomputer. 

Midtier  Computer  Systems.  In  open  systems,  the  minicomputer  normally 
operates  at  the  midtier,  a  level  between  the  workstation  and  the  mainframe 
computer.  Accordingly,  the  minicomputer  is  called  a  midtier  computer. 

Use  of  midtier  computer  equipment  has  increased  because  computer  vendors  are 
moving  from  proprietary  to  open  systems,  and  the  market  solution  to  open 
systems  is  the  minicomputer.  Therefore,  selection  of  the  minicomputer,  or 
midtier  computer,  has  become  the  primary  method  for  the  DoD  program 
manager  to  meet  user  functional  requirements  and  to  comply  with  the  Technical 
Architecture  Framework  for  Information  Management. 

On  March  30,  1995,  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  reiterated  the  DoD  requirement  to  comply 


2Amount  was  shown  in  Footnote  15  to  the  Defense  Business  Operations  Fund- 
Defense  Information  Services  Organization  Financial  Statements  for  FY  1994. 

3 A  multi-user  computer  operating  system  developed  by  Bell  Laboratories. 
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with  the  Technical  Architecture  Framework  for  Information  Management  and 
the  open  systems  concept.  The  requirement  also  applies  to  migration  systems.4 
A  migration  system  is  an  automated  information  system  designated  to  support 
DoD  Component-wide  or  DoD-wide  standard  business  processes. 


Implementing  Solutions  in  Support  of  DoD  Information 
Management  Goals 


The  Deputy  Secretary  of  Defense  directed  in  the  October  13,  1993, 
memorandum,  "Accelerated  Implementation  of  Migration  Systems,  Data 
Standards,  and  Process  Improvements,"  that  the  Principal  Staff  Assistants  select 
standard,  DoD-wide,  migration  systems.  For  this  audit,  we  reviewed  the 
computer  hardware  of  four  migration  systems  under  development  that  will 
process  corporate  information:  two  logistics  systems,  one  personnel  system, 
and  one  procurement  system.  Specifically,  those  systems  are  the  Depot 
Maintenance  Standard  System,  the  Materiel  Management  Standard  System  (both 
logistics  standard  systems),  the  Defense  Civilian  Personnel  Data  System,  and 
the  Standard  Procurement  System.  The  hardware  solutions  for  those  systems 
could  create  redundant  data  processing  centers  because  DoD  policy  on  managing 
midtier  computers  is  unclear. 

Logistics  Standard  Systems.  On  February  13,  1992,  the  Assistant  Secretary  of 
Defense  (Production  and  Logistics)5  approved  the  charter  for  the  Joint  Logistics 
Systems  Center.  In  the  memorandum,  "Joint  Logistics  Systems  Center 
Charter,"  the  Assistant  Secretary  tasked  the  Joint  Logistics  Systems  Center  to 
implement  Corporate  Information  Management  principles  and  concepts  for  DoD 
'  logistics  functions.  To  accomplish  that  task,  the  Joint  Logistics  Systems  Center 
manages  the  design  and  development  of  two  DoD  logistics  standard  systems,  the 
Depot  Maintenance  Standard  System  and  the  Materiel  Management  Standard 
System. 

Upon  implementation  of  the  systems,  the  mainframe  computers  for  the  Depot 
Maintenance  and  Materiel  Management  Standard  Systems  will  be  owned  and 
operated  by  the  Defense  Information  Systems  Agency.  However,  responsibility 
for  acquiring  midtier  computers  has  not  been  consistent.  Midtier  computer 
acquisitions  changed  each  year  from  FYs  1993  through  1995.  The  Defense 
Information  Systems  Agency  was  funded  to  acquire  midtier  computer  hardware 
for  FY  1993.  However,  in  FY  1994  the  funding  for  midtier  computer  hardware 


4Migration  systems  are  those  automated  information  systems  designated  for 
interim  use  for  functional  processes  on  a  DoD-wide  basis  during  the  transition 
from  numerous  existing  (legacy)  and  nonstandard  automated  information 
systems  to  functional  standard  systems. 

5After  a  subsequent  reorganization,  the  duties  of  the  position  that  are  relevant  to 
this  discussion  were  assumed  by  the  Deputy  Under  Secretary  of  Defense  for 
Logistics. 
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was  withdrawn  from  the  Defense  Information  Systems  Agency  and  given  to  the 
Joint  Logistics  Systems  Center.  For  FY  1995,  Program  Budget  Decision  401, 
"Business  Operations  Corporate,"  December  19,  1993,  directed  that  DoD 
Components  rather  than  the  Joint  Logistics  Systems  Center  acquire  midtier 
computers. 

The  Defense  Information  Systems  Agency  received  a  total  of  $117.8  million  in 
FY  1993  to  buy  computer  equipment  for  the  DoD  logistics  standard  systems.  In 
FY  1994,  the  Joint  Logistics  Systems  Center  received  $91.2  million  to  purchase 
computer  equipment.  The  Joint  Logistics  Systems  Center  estimated  FYs  1995 
through  1997  funding  requirements  for  midtier  computers  and  computer 
workstations  at  $70.4  million  to  support  the  Depot  Maintenance  Standard 
System  and  at  $108.6  million  to  support  the  Materiel  Management  Standard 
System. 

Depot  Maintenance  Standard  System.  The  Depot  Maintenance 
Standard  System  consists  of  eight  subsystems  and  has  an  estimated  life-cycle 
cost  of  $2.8  billion.  The  subsystems  support  the  three  major  depot  maintenance 
business  processes  of  project  management,  repairable  management,  and 
specialized  support,  such  as  tracking  hazardous  materials.  Three  sites  began 
implementation  of  the  Depot  Maintenance  Standard  System  in  FY  1995. 
Further,  the  program  manager  anticipates  full  operating  capability  at  20  major 
depots  in  FY  2002.  The  Depot  Maintenance  Standard  System  will  use  both 
mainframe  and  midtier  computers  to  process  data. 

Materiel  Management  Standard  System.  The  Materiel  Management 
Standard  System  consists  of  10  subsystems  and  has  an  estimated  life-cycle  cost 
of  $4.4  billion.  The  system  supports  four  major  materiel  management  business 
processes:  asset  management,  supply  data,  technical  data,  and  requirements 
determination.  The  Materiel  Management  Standard  System  will  support 
$77.5  billion  in  national-level  inventories  at  17  inventory  control  locations  and 
will  process  about  2.2  billion  transactions  annually.  The  10  subsystems  will 
operate  on  a  combination  of  mainframe  and  midtier  computers. 

Defense  Civilian  Personnel  Data  System.  The  Deputy  Secretary  of  Defense 
established  the  Civilian  Personnel  Management  Service  and  on  August  30, 
1993,  tasked  it  to  modernize  the  civilian  personnel  system.  Program  Budget 
Decision 711,  "Corporate  Information  Management  (CIM)  Initiatives," 
December  5,  1994,  created  the  Defense  Civilian  Personnel  Data  System 
modernization  program.  The  program  will  consolidate  all  DoD  civilian 
personnel  data  into  a  single,  standardized  data  base.  The  personnel  data  base 
will  serve  23  regional  service  centers  and  330  customer  service  units.  The 
program  manager  estimated  the  program's  life-cycle  costs  at  $157  million  and 
that  initial  operational  capability  would  occur  in  FY  1998.  Upon  full 
operational  capability,  ownership  of  a  specialized  midtier  computer  used  to 
process  the  central  data  base  will  transfer  to  the  Defense  Information  Systems 
Agency.  The  23  regional  service  centers  and  330  customer  service  units  will 
acquire,  operate,  and  maintain  the  midtier  computers  needed  to  support 
operations,  which  the  program  manager  estimated  will  total  about  $22  million. 
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Standard  Procurement  System.  The  Standard  Procurement  System  will 
operate  at  the  Defense  Supply  Centers  to  automate  the  development,  review, 
approval,  printing,  and  issuance  of  solicitations  and  contract  awards.  The 
system  will  replace  9  major  preaward  procurement  systems  used  by  about 
25,500  users  at  546  sites.  The  Defense  Logistics  Agency  program  manager 
estimated  life-cycle  costs  for  the  Standard  Procurement  System  at  $1.1  billion. 
The  Defense  Logistics  Agency  is  developing  the  system  incrementally,  with  full 
operational  capability  planned  for  FY  2000.  The  Standard  Procurement  System 
will  use  mainframe  computers  at  three  Defense  megacenters  to  store  and  process 
the  central  data  base.  The  Standard  Procurement  System  program  office  also 
planned  to  acquire  midtier  computers  to  process  corporate  data.  However, 
according  to  the  Deputy  Program  Manager,  the  Standard  Procurement  System 
program  office  will  not  acquire  midtier  computers  for  the  DoD  Components. 
The  DoD  Components  will  acquire  any  needed  midtier  computers. 

Effects  of  the  Hardware  Solutions  for  the  Four  Information  Systems.  The 
Depot  Maintenance  Standard  System,  the  Materiel  Management  Standard 
System,  the  Defense  Civilian  Personnel  Data  System,  and  the  Standard 
Procurement  System  all  relied  on  or  will  rely  very  heavily  on  the  midtier 
computer  to  meet  corporate  information  processing  requirements.  In  total, 
program  managers  plan  to  acquire  about  $200  million6  in  midtier  computer 
equipment  for  their  systems.  Without  clear  policy,  those  systems,  developed  in 
compliance  with  the  Technical  Architecture  Framework  for  Information 
Management,  may  be  used  to  create  data  processing  centers  that  will  result  in 
excess  computer  information  processing  capacity  in  die  DoD. 


DoD  Guidance  on  Storing  and  Processing  Corporate 
Information 


Effects  of  CIM  Plan  on  CIM  Goals.  A  goal  of  the  DoD  Corporate 
Information  Management  Strategic  Plan  (the  Plan),  June  1994,  is  to  "tie  DoD 
together  through  the  use  of  common,  shared  data."  The  Plan  includes 
interoperability  in  DoD  among  different  functional  areas  as  well  as  minimizing 
expenditures  for  computer  equipment  to  process  the  functional  data.  For  DoD 
to  meet  those  goals,  die  Plan  requires  DoD  managers  to  provide  for  the  efficient 
capture,  collection,  processing,  storage,  and  dissemination  of  data.  However, 
the  Plan  does  not  specify  procedures  for  DoD  managers  to  use  in  accomplishing 
those  tasks. 

Data  Processing  and  Storage  Efficiencies  in  Support  of  the  CIM  Plan. 
Efficient  data  processing  and  storage  are  elements  of  a  DoD  strategic  goal,  yet 
specific  policy,  such  as  DoD  Directive  8120.1,  "Life-Cycle  Management  of 
Automated  Information  Systems,"  January  14,  1993,  implements  guidance  for 


6Depot  Maintenance  Standard  System-$70.4  million,  Materiel  Management 
Standard  System-$  108. 6  million,  Defense  Civilian  Personnel  Data  System- 
$22  million. 
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compliance  on  a  program-by-program  basis.  In  other  words,  as  illustrated  by 
the  four  major  information  systems  reviewed  for  this  report,  DoD  strategic 
goals  are  specified  on  a  global  basis,  but  implemented  on  an  individual  program 
basis  and,  therefore,  do  not  necessarily  support  management  strategy. 
Additionally,  DoD  Instruction  8120.2,  "Automated  Information  System 
Life-Cycle  Management  Process,  Review,  and  Milestone  Approval 
Procedures,"  January  14,  1993,  does  not  require  a  functional  economic  analysis, 
which  includes  proposed  hardware  solutions  across  DoD  functional  areas. 

DoD  Managers  Need  to  Coordinate.  Although  the  program  managers 
developed  computer  hardware  solutions  in  compliance  with  existing  DoD 
policy,  they  did  not  coordinate  their  requirements  with  other  systems  program 
managers.  The  program  managers  did  not  coordinate  requirements  because  the 
DoD  did  not  have  a  policy  that  integrated  midtier  computer  policy  requirements 
with  mainframe  policy  requirements.  We  believe  that  the  DoD  could  improve 
coordination  of  corporate  information  processing  needs. 


Coordinating  Corporate  Information  Processing  Needs 


Coordination  of  corporate  information  processing  requirements  would  better 
support  DoD  information  management  goals.  Specifically,  we  believe  that 
improving  the  coordination  of  the  acquisition  and  management  of  computers  that 
process  corporate  information  would  provide: 

o  more  effective  use  of  the  open  systems  infrastructure  concept  to 
resolve  operational  problems; 

o  more  efficient  tracking  and  reporting  of  information  management 
costs  on  a  DoD-wide  basis; 

o  better  management  of  the  transition  from  existing,  outdated  systems  to 
migration  systems; 

o  more  effective  management  of  computer  security  through  use  of 
standard  software  and  setup  procedures,  consistent  monitoring  of  user  access 
authority,  and  application  of  specialized  tools  to  address  common  security 
weaknesses; 

o  common  and  consistent  support,  diagnosis,  and  repair; 

o  uniform  operational  policies,  standards,  and  procedures; 

o  new  technology  identification  and  transition  assistance; 
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o  central  validation  of  quality  suppliers  for  computer  software, 
hardware,  and  services;  and 

o  common  training  of  users. 


Consolidation  of  Data  Centers 


On  October  4,  1995,  the  Office  of  Management  and  Budget  issued  Bulletin 
No.  96-02,  "Consolidation  of  Agency  Data  Centers,"  to  provide  guidelines  for 
reducing  the  number  of  agency  data  centers  and  the  total  cost  of  data  center 
operations  Government  wide.  The  Bulletin  calls  for  agencies  to: 

o  reduce  the  total  number  of  agency  data  centers  during  the  next  24 
months, 

o  collocate  small  and  midtier  computing  platforms  in  larger  data 
centers, 

o  modernize  remaining  data  centers  to  improve  services,  and 

o  contract  out  information  processing  requirements  to  other  Federal  or 
commercial  data  centers  if  the  aggregate  installed  base  is  below  minimum  target 
sizes. 

The  Bulletin  requires  the  head  of  each  agency  to  complete  consolidations  by 
June  1998. 

On  November  6,  1995,  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  a  memorandum  for  Directors  of  the 
Defense  Agencies  to  provide  guidance  on  responding  to  the  requirements  of 
Bulletin  No.  96-02.  The  memorandum  lists  three  tasks  that  must  be 
accomplished  by  the  DoD:  prepare  an  inventory  of  data  centers;  develop  a  data 
center  consolidation  strategy;  and  submit  a  detailed  implementation  plan  to  the 
Office  of  Management  and  Budget. 


Summary 


The  DoD  does  not  yet  have  a  clear  policy  on  the  acquisition  and  management  of 
the  infrastructure  that  supports  corporate  information  data  processing 
requirements.  Specifically,  a  management  policy  gap  exists  between  the 
guidance  in  Defense  Management  Report  Decision  918  and  guidance  in  the 
Technical  Architecture  Framework  for  Information  Management.  However,  the 
recent  Office  of  Management  and  Budget  initiative  to  consolidate  agency  data 
centers  will  result  in  policy  changes  affecting  the  management  of  midtier 
computers. 
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Recommendation,  Management  Comments,  and  Audit 
Response 


Revised  Finding  and  Deleted  Recommendation.  After  the  draft  report  was 
issued  on  September  25,  1995,  we  met  with  representatives  of  the  Deputy 
Assistant  Secretary  of  Defense  (Information  Management)  to  discuss 
management  comments.  The  primary  focus  of  the  discussion  was  the  effects  of 
Office  of  Management  and  Budget  Bulletin  No.  96-02  (the  Bulletin),  on  the 
draft  recommendations.  Among  other  actions,  the  Bulletin  requires  the 
consolidation  of  small  and  midtier  computing  platforms  into  larger  data  centers. 
The  DoD  is  required  to  develop  an  inventory  of  data  centers  by  March  1,  1996, 
and  to  complete  consolidations  by  June  1998.  The  Deputy  Assistant  Secretary 
of  Defense  (Information  Management)  believes  that  because  data  center 
consolidation  will  occur  as  a  result  of  requirements  in  the  Bulletin,  additional 
policy  in  managing  midtier  computers  is  not  needed  at  this  time.  Therefore, 
based  on  management  comments  and  additional  audit  review,  we  added  a 
section  to  the  final  report  entitled  "Consolidation  of  Data  Centers"  to  explain  the 
effects  of  the  Bulletin  and  we  deleted  draft  report  Recommendation  1.  to  revise 
DoD  information  infrastructure  policy  to  include  management  of  midtier 
computers  that  process  corporate  information. 

We  recommend  that  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  establish  procedures  for 
evaluating  and  providing  corporate  information  processing  and  storage 
requirements  on  a  DoD-wide  basis  rather  than  on  an  individual  program 
basis. 

Management  Comments.  The  Deputy  Assistant  Secretary  of  Defense 
(Information  Management)  concurred  with  the  recommendation.  While  senior 
DoD  management  placed  limitations  on  further  centralization  of  corporate 
information  processing  and  storage  requirement  efforts  required  by  Defense 
Management  Report  Decision  918,  the  Deputy  Assistant  Secretary  stated  that,  in 
the  near  term,  the  implementation  of  die  Bulletin  would  provide  a  sound 
foundation  for  better  planning  for  computer  capacity  and  DoD-wide  data 
sharing.  Decisions  on  changing  information  infrastructure  policy  will  have  to 
be  deferred  until  the  data  center  consolidation  requirements  of  the  Bulletin  are 
complete.  The  Assistant  Secretary  nonconcured  with  our  identification  of  a 
material  management  control  weakness,  stating  that  the  weakness  is  not  well 
defined  and  that  redundant  computing  capacity  is  not  necessarily  an  example  of 
waste,  fraud,  and  abuse. 

Audit  Response.  We  consider  management  comments  responsive  to  the  intent 
of  the  recommendation.  Because  the  Bulletin  includes  a  requirement  for  an 
inventory  and  consolidation  of  midtier  computers  into  data  processing  centers, 
we  agree  with  the  Deputy  Assistant  Secretary  of  Defense  (Information 
Management)  that  ongoing  actions  will  provide  data  on  the  quantity  and  location 
of  computer  platforms,  including  midtier  computers  within  the  DoD,  that  can  be 
used  to  establish  or  revise  policy  on  managing  DoD  information 
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infrastructure.  We  also  believe  that  policy  changes  resulting  from 
implementation  of  the  Bulletin  will  correct  the  material  management  control 
weakness  identified  in  the  report. 
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Appendix  A.  Audit  Process 

Scope 


Corporate  Information  Processing  Systems.  We  reviewed  the  computer 
software  and  hardware  development  of  four  major  DoD  standard  information 
systems:  the  Materiel  Management  Standard  System,  the  Depot  Maintenance 
Standard  System,  the  Defense  Civilian  Personnel  Data  System,  and  the  Standard 
Procurement  System.  Specifically,  we  analyzed  the  processes  to  acquire, 
manage,  and  operate  computers  needed  to  run  the  standard  software. 


Methodology 


DoD  Guidance  on  Processing  and  Storage  of  Corporate  Information.  We 
reviewed  and  analyzed  policy  and  guidance  on  the  operations  and  design  of 
DoD  computer  systems.  Specifically,  we  analyzed  policy  implemented  by  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence).  We  also  analyzed  guidance  on  the  design  of  open  computer 
systems  as  explained  in  the  "Technical  Architecture  Framework  for  Information 
Management."  We  compared  the  policy  and  guidance  for  consistency  regarding 
the  use  of  mainframe  and  minicomputer  systems. 

Use  of  Computer-Processed  Data  and  Statistical  Sampling.  We  did  not  use 
computer-processed  data  or  statistical  sampling  procedures  for  this  audit. 

Use  of  Technical  Assistance.  Software  engineers  from  the  Technical 
Assessment  Division,  Office  of  the  Inspector  General,  DoD,  assisted  in 
evaluating  technical  documentation. 

Audit  Period,  Standards,  and  Locations.  We  performed  this  program  audit 
from  March  through  August  1995  in  accordance  with  auditing  standards  issued 
by  the  Comptroller  General  of  the  United  States,  as  implemented  by  the 
Inspector  General,  DoD.  We  included  tests  of  management  controls  considered 
necessary.  Appendix  E  lists  the  organizations  we  visited  or  contacted. 


Management  Control  Program 


DoD  Directive  5010.38,  "Internal  Management  Control  Program,"  April  14, 
1987,  requires  DoD  organizations  to  implement  a  comprehensive  system  of 
management  controls  that  provides  reasonable  assurance  that  programs  are 
operating  as  intended  and  to  evaluate  the  adequacy  of  those  controls. 
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Scope  of  Review  of  Management  Control  Program.  Specifically,  we 
reviewed  management  controls  established  by  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence)  over  policy  and 
procedures  relating  to  the  acquisition  and  management  of  computers  that  process 
corporate  information.  We  interviewed  the  management  control  program  focal 
point  and  the  official  responsible  for  policy  review  and  coordination. 

Adequacy  of  Management  Controls.  We  identified  a  material  management 
control  weakness  within  the  Office  of  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence)  as  defined  by  DoD 
Directive  5010.38  relating  to  policy  and  procedures  for  the  acquisition  and 
management  of  computers  that  process  corporate  information.  The  material 
management  control  weakness  is  the  gap  in  policy  for  the  acquisition  and 
management  of  computers  that  process  corporate  information.  Policy  changes 
that  will  result  from  Office  of  Management  and  Budget  Bulletin  No.  96-02  and 
from  the  report  recommendation,  when  implemented,  will  correct  the  weakness 
and  will  result  in  unquantifiable  potential  monetary  benefits  (Appendix  D).  A 
copy  of  die  final  report  will  be  provided  to  the  senior  official  responsible  for 
management  controls  in  the  Office  of  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communication,  and  Intelligence). 

Adequacy  of  Management's  Self-Evaluation.  Office  of  the  Assistant 
Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
did  not  specifically  assess  the  policy  for  acquiring  and  managing  computers  that 
process  corporate  data  as  part  of  the  self-evaluation  of  management  controls. 
Therefore,  the  officials  did  not  identify  or  report  in  the  Annual  Statement  of 
Assurance  the  material  control  weakness  identified  by  the  audit. 
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During  the  last  5  years,  the  General  Accounting  Office  (GAO)  and  the  Office  of 
the  Inspector  General,  DoD,  have  each  issued  several  reports  related  to  the  DoD 
Corporate  Information  Management  initiative.  We  reviewed,  selected,  and 
summarized  the  reports  most  relevant  to  the  scope  of  this  audit. 


General  Accounting  Office 


GAO  Report  No.  NSIAD-95-28  (OSD  Case  No.  9660),  "Impediments 
Jeopardize  Logistics  Corporate  Information  Management,"  October  21,  1994, 
states  that  the  CIM  initiative  has  had  little  effect  on  materiel  management  and 
depot  maintenance  business  practices.  The  report  recommends  that  the 
Secretary  of  Defense  revise  the  CIM  management  strategy  to  ensure  that  DoD 
functional  managers  reengineer  DoD  business  processes,  train  DoD  employees 
in  an  organization's  business  practices,  and  rename  the  initiative  to  accurately 
communicate  its  primary  objective  to  all  employees. 

GAO  Report  No.  NSIAD-94-101  (OSD  Case  No.  9652),  "Stronger  Support 
Needed  for  Corporate  Information  Management  Initiative  to  Succeed," 
April  12,  1994,  states  that  the  DoD  efforts  to  reengineer  its  business  processes, 
to  standardize  and  integrate  data,  and  to  improve  its  information  systems  under 
CIM  have  yielded  mixed  results.  The  report  recommends  that  the  Secretary  of 
Defense  develop  a  CIM  management  strategy,  obtain  the  views  of  outside  expert 
practitioners  to  provide  independent  perspectives  on  CIM,  develop  a  CIM 
strategic  plan,  ensure  an  appropriate  balance  between  efforts  to  reengineer 
business  practices  and  to  standardize  systems,  require  that  migration  systems  be 
supported  by  sound  economic  and  technical  analyses,  require  a  cost-benefits 
assessment,  and  direct  the  Principal  Staff  Assistants  to  establish  plans  consistent 
with  the  CIM  strategic  plan. 

GAO  Report  No.  AIMD-94-14  (OSD  Case  No.  9586),  "Management 
Commitment  Needed  to  Achieve  Defense  Data  Administration  Goals," 
January  1,  1994,  states  that  die  DoD  has  not  been  able  to  properly  determine  its 
corporate  data  needs.  The  report  recommends  that  the  Secretary  of  Defense 
require  Principal  Staff  Assistants  to  document  their  business  methods  and 
performance  measures  before  developing  process  and  data  models. 


Inspector  General,  DoD 


Inspector  General,  DoD,  Report  No.  95-269,  "Oversight  Process  of  the  Major 
Automated  Information  Systems  Review  Council,"  June  30,  1995,  states  that  the 
Major  Automated  Information  System  Review  Council  review  process  has  not 
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been  reengineered  to  reflect  changes  in  acquisition  methods  used  to  develop  or 
modernize  major  automated  information  systems.  The  report  recommends 
revising  DoD  regulations  to  specify  procedures  to  involve  the  Major  Automated 
Information  Systems  Review  Council  in  ongoing  CIM  efforts  and  to  specify 
procedures  for  the  Council  to  use  in  assessing  major  automated  information 
systems.  The  Deputy  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence  Acquisition)  generally  concurred  with  the 
recommendations  in  the  report,  and  is  incorporating  recommendations  in  the 
revisions  to  relevant  DoD  directives  and  manuals. 

Inspector  General,  DoD,  Report  No.  3RE-2017,  "Report  on  the  Implementation 
of  Defense  Management  Report  Decision  918,"  June  15,  1994,  evaluates  the 
DoD  implementation  of  Defense  Management  Report  Decision  918,  "Defense 
Information  Infrastructure."  The  report  summarizes  congressional  and  DoD 
actions  taken  from  September  15,  1992,  the  date  the  Defense  Management 
Report  Decision  918  was  implemented,  through  March  1994,  the  date  audit 
work  was  completed. 

Inspector  General,  DoD,  Program  Evaluation  Report,  "Defense  Corporate 
Information  Management  Initiative,"  January  28,  1993,  responds  to  questions 
from  the  Director  of  Defense  Information  on  the  status  of  the  CIM 
implementation  plan  and  how  DoD  was  institutionalizing  the  CIM  initiative. 
The  report  concludes  that  tasks  associated  with  the  CIM  implementation  plan 
had  been  completed  or  incorporated  into  the  duties  and  responsibilities  of  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  and  other  DoD  Components.  On  the  other  hand,  the  report 
concludes  that  institutionalizing  the  CIM  initiative  was  severely  hampered  by 
the  lack  of  an  overall  CIM  plan. 
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Central  Design  Activities.  The  primary  purpose  of  DoD  Component  central 
design  activities  is  to  support  DoD  Component  development  and  maintenance  of 
automated  information  systems.  About  90  percent  of  the  central  design  activity 
effort  is  spent  to  support  existing  software  systems,  and  about  10  percent  is 
spent  on  new  system  development.  In  FY  1994,  the  DoD  had  32  central  design 
activities  with  a  budget  of  about  $1 . 1  billion. 

Effective  November  1,  1992,  Defense  Management  Report  Decision  918 
transferred  from  the  DoD  Components  to  the  Defense  Information  Systems 
Agency  all  central  design  activity  assets  and  personnel  associated  with  software 
design,  development,  reengineering,  maintenance,  systems  integration,  and 
common  support  activities.  However,  on  May  7,  1993,  the  Deputy  Secretary  of 
Defense  delayed  transfer  of  the  central  design  activities.  Subsequently,  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  directed  the  immediate  return  of  the  central  design  activities  to  the 
DoD  Components  on  June  28,  1993.  Because  the  development  and  maintenance 
of  software  at  the  central  design  activities  is  separate  from  the  acquisition  and 
management  of  computer  hardware  and  the  Defense  information  infrastructure, 
we  believe  the  ability  of  the  DoD  to  effectively  coordinate  corporate 
information  processing  is  hampered. 
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Appendix  D.  Summary  of  Potential  Benefits 
Resulting  from  Audit 


Recommendation 

Reference 

Description  of  Benefit 

Amount  and 

Type  of  Benefit 

1. 

Management  Controls  and  Economy 
and  Efficiency.  Creates  procedures 
for  the  acquisition  and  management 
of  midtier  and  mainframe  computers 
that  do  not  duplicate  processing 
capabilities  already  within  the  DoD. 

Undeterminable. 
Monetary  amount 
would  vary  according 
to  the  site  and  type  of 
computer  equipment. 

Appendix  E.  Organizations  Visited  or  Contacted 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller),  Washington,  DC 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and  Intelligence), 
Washington,  DC 

Deputy  Under  Secretary  of  Defense  (Logistics),  Washington,  DC 
Director,  Program  Analysis  and  Evaluation,  Washington,  DC 


Department  of  the  Army 

Headquarters,  Department  of  the  Army,  Washington,  DC 


Department  of  the  Navy 

Headquarters,  Department  of  the  Navy,  Washington,  DC 


Department  of  the  Air  Force 

Air  Force  Military  Personnel  Center,  Randolph  Air  Force  Base,  TX 


Other  Defense  Organizations 

Joint  Logistics  Systems  Center,  Wright-Patterson  Air  Force  Base,  OH 
DoD  Civilian  Personnel  Management  Service,  Washington,  DC 


Defense  Agencies 

Defense  Information  Systems  Agency,  Arlington,  VA 

Defense  Information  Systems  Agency,  Western  Hemisphere,  Denver,  CO 
Defense  Information  Systems  Agency,  Western  Hemisphere,  Fort  Ritchie,  MD 
Defense  Logistics  Agency,  Alexandria,  VA 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Director,  Program  Analysis  and  Evaluation 
Under  Secretary  of  Defense  for  Personnel  and  Readiness 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and  Intelligence) 
Deputy  Under  Secretary  of  Defense  (Logistics) 

Assistant  to  the  Secretary  of  Defense  (Public  Affairs) 

Director,  Joint  Staff 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  die  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Commander,  Joint  Logistics  System  Center 
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Appendix  F.  Report  Distribution 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Part  III  -  Management  Comments 


Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence) 
Comments 


OFFICE  OF  THE  ASSISTANT  SECRETARY  OF  DEFENSE 
6000  DEFENSE  PENTAGON 
WASHINGTON.  D.C.  20301-6000 


Ndv  29  1995 


MEMORANDUM  FOR  DIRECTOR  OF  READINESS  AND  OPERATIONAL  SUPPORT , 

DOD  IG 

SUBJECT:  Audit  Report  on  Acquisition  of  Computers  That  Process 

Corporate  Information  (Project  No.  5RE-0035) 

This  is  in  response  to  your  memorandum,  dated  September  25, 
1995,  on  the  above  subject. 

Consistent  with  your  request,  attached  are  comments  on  the 
findings,  conclusions,  and  recommendations  contained  in  the 
subject  report.  You  will  note  that  we  continue  to  have  some 
concerns  about  the  centralization  implications  of  the  report. 

The  provision  of  corporate  information  processing  and  storage 
requirements  on  a  DoD-wide  basis  will  likely  require  further 
centralization  such  as  that  envisioned  under  the  final 
implementation  of  Defense  Management  Report  Decision  (DMRD)  918. 
However,  due  deliberation  and  consultation  among  senior 
management  within  the  Department  resulted  in  limitations  being 
placed  on  further  DMRD  918  activity.  Consequently,  any  DoD-wide 
evaluation  and  provision  of  information  processing  and  storage 
requirements  will  need  to  proceed  with  care. 

Questions  regarding  this  matter  may  be  directed  to  Ms. 
Scarlett  Curry,  (703)  614-1953,  of  ray  staff. 

Cynthia  Kendall 

Deputy  Assistant  Secretary  of  Defense 
(Information  Management) 

Attachment 


o 
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Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 

Intelligence)  Comments 


COMMENTS 

ON 

AUDIT  REPORT  ON  ACQUISITION  OF  COMPUTERS  THAT  PROCESS  CORPORATE 
INFORMATION  (PROJECT  NO.  5RE-0035) 


Page  2,  Paragraph  It  The  Corporate  Information  Management 
initiative  was  "announced"  in  a  memorandum,  signed  by  the  Deputy 
Secretary  of  Defense  and  dated  October  4,  1989.  Key  elements  of 
this  memorandum  were: 

•  the  objective  of  improving  the  standardization,  quality, 
and  consistency  of  data  from  DoD's  multiple  management 
information  systems,  and 

•  the  establishment  of  an  executive  level  group  to 
recommend  an  overall  approach  and  action  plan  to  enhance 
the  availability  and  standardization  of  information  in 
common  areas  through  a  Corporate  Information  Management 
program . 

The  Secretary's  memorandum,  * Implementation  of  Corporate 
Information  Management  Principles, *  dated  November  16,  1990 
(e.g.,  the  memorandum  cited  in  the  audit  report)  announced  the 
completion  of  the  executive  level  group's  work,  and  assigned 
certain  implementation  responsibilities  to  the  Assistant 
Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence) . 

Page  2,  Paragraph  2:  The  Deputy  Secretary  of  Defense  signed  the 
Defense  Management  Report  Decision  918,  "Defense  Information 
Infrastructure,'1'  rather  than  the  Secretary  of  Defense  as  stated 
in  the  report. 

Page  4,  Paragraph  It  Reference  the  sentence,  "Coordinated 
acquisition  and  management  were  not  achieved  because  requirements 
stated  in  Defense  Management  Report  Decision  918,  which  focused 
on  mainframe  computers,  have  not  been  integrated  with  the 
standards  of  the  Technical  Architecture  Framework  for  Information 
Management  to  address  midtier  computer  processing." 

This  statement  is  confusing,  lacks  substance  and  rationale,  and 
requires  further  clarification.  Specifically,  what  DMRD  918 
requirements  have  not  been,  but  need  to  be,  integrated  with  the 
standards  of  the  TAFIM?  Even  if  some  requirements  of  DMRD  918 
were  integrated  with  the  standards  of  the  TAFIM,  it  is  not  clear 
how  this,  in  and  of  itself,  would  result  in  the  coordinated 
acquisition  and  management  of  certain  computers.  Further, 
although  there  maybe  a  need  for  a  midtier  computer  policy,  or 
perhaps  more  appropriately  DoD-wide  computer  capacity  planning, 
the  TAFIM  is  not  necessarily  the  place  for  such  policy.  As 
currently  written,  the  statement  implies  that  the  TAFIM  is 
lacking  with  regard  to  a  vague  policy  issue. 


Final  Report 
Reference 


Revised 
Page  2 


Revised 
Page  2 
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Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  Comments 


We  do  not  believe  the  focus  of  DMRD  918  was  limited  to  mainframe 
computers.  For  example,  the  intent  of  DMRD  918  was  to  make  DISA 
•responsible  for  . . .DPIs  , . .  including  distributed  office 
automation  systems. "  Similarly,  according  to  the  Defense 
Information  Infrastructure  Implementation  Plan,  dated  January  14, 
1993,  *the  approach  herein  focuses  on  reducing  the  number  of 
mainframe  and  minicomputer  sites  . . . "  The  intent  was  to  address 
DPI  and  mainframe  assets  in  Phase  I  of  Stage  I;  other  computing 
resources  would  be  addressed  in  follow-on  Phases/Stages  of  DMRD 
918  implementation. 

Finally,  the  statement,  when  viewed  in  conjunction  with 
Recommendation  1,  implies  that  DMRD  918  should  be  revised.  The 
Secretary  of  Defense  and  the  ASD(C3I)  in  memoranda,  dated 
May  1993  and  June  1993,  respectively,  directed  the  final 
disposition  of  DMRD  918  --  both  of  which  limited  further  DMRD  918 
activity.  It  is  unlikely  that  DMRD  918  will  be  revised. 


Page  5,  Paragraph  entitled,  "Defense  Management  Report  Decision 
91 B":  The  relevance  of  this  paragraph  is  unclear.  Further,  any 
discussion  of  DMRD  918  should  be  within  the  context  of  its 
accompanying  resource  and  implementation  plans  as  well  as  the  May 
1993  and  June  1993  memoranda  cited  above.  For  example,  while  the 
goal  of  DMRD  918  was  to  consolidate  all  data  processing 
installations  resources  as  well  as  other  computing  assets  under 
the  control  of  the  DISA,  subsequent  restrictions  were  put  on  some 
of  this  activity. 


Page  5,  Paragraph  entitled,  "Technical  Architecture  Framework  for 
Information  Management":  Within  DoD,  UNIX  is  not  the  basis  for 
defining  open  systems  standards.  POSIX  is  the  fundamental 
standard  for  operating  systems.  POSIX  and  UNIX  are  not 
synonymous.  The  TAFIM  does  not  mention  UNIX,  and  does  not  deal 
with  a  specific  brand  of  operating  system. 


Page  9:  The  two  fundamental  issues  of  the  report  are  alluded  to 
on  page  9  --  (1)  whether  the  Department  has  established  adequate 
procedures  consistent  with  its  policy  of  data  sharing,  and 
(2)  whether  the  Department  has  done  a  reasonable  job  of 
corporate -wide  computer  capacity  planning  irrespective  of  the 
size  of  the  computer  used. 

The  issue  is  not  midtier  policy  requirements;  rather,  it  is  one 
of  ensuring  that  DoD  has  adequate  procedures  and  guidelines  that 
deal  with  corporate -wide  capacity  planning,  ensuring  that  such 
procedures  are  incorporated  into  the  acquisition  process  for  all 
systems,  and  that  adequate  management  controls  are  instituted  to 
avoid  unnecessary  duplication. 
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Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 

Intelligence)  Comments 


Currently,  DoD  policy  and  a  variety  of  other  regulatory  issuances 
require  an  evaluation  of  existing  capacity  before  acquiring  new 
information  technology.  The  report  suggest  that  these  policies 
have  not  been  effective.  But  issuing  more  policies,  resurrecting 
DMRD  918,  and  instituting  an  impractical  approach  of  having  each 
program  manager  consult  or  coordinate  with  every  other  program 
manager  before  acquiring  information  processing  capability  would 
not  appear  to  be  solutions. 

The  report  indicates  that  *DoD  strategic  goals  are  specified  on  a 
global  basis,  but  implemented  on  an  individual  program  basis  and, 
therefore,  do  not  necessarily  support  management  strategy. H  Yet, 
a  recommendation  is  to  revise  and  issue  policy  which  is  also 
global  in  nature.  The  inference  being  that  globally  issued 
policy  which  is  implemented  on  an  individual  basis  somehow  will 
necessarily  be  a  solution. 


Recommendation  li  Revise  DoD  information  infrastructure  policy 
to  include  management  of  midtier  computers  that  process  corporate 
information. 

Response:  Nonconcur.  The  basis  for  this  position  is  as  follows: 

•  Revision  of  the  DoD  information  infrastructure  (DII) 
policy  implies  that  such  a  policy  exists.  However,  the 
key  DII  policy  alluded  to  in  the  report  is  DMRD  918, 

* Defense  Information  Infrastructure. #  Hence,  it  would 
appear  that  the  recommendation  is  suggesting  that  DMRD 
918  be  revised.  Such  an  action  is  unlikely  and 
impractical . 

•  The  recommendation  infers  that  a  globally  issued  policy 
on  midtier  computers  which  is  implemented  on  an 
individual  program  basis  will  necessarily  support 
management  strategy  and  be  effective.  Even  the  report 
suggests  that  this  may  not  be  the  case. 

•  The  recommendation  is  vague,  too  narrowly  focused,  and 
provides  limited  insight  regarding  what  such  a  policy 
would  espouse  beyond  the  general  notion  of  improving  the 
coordination  process  for  acquiring  and  managing  midtier 
computers . 

•  Existing  DoD  policy  applies  to  midtier  computers .  These 
policies  include  DoD  Directive  (DoDD)  8000.1,  DoDD 
8120.1,  DoD  Instruction  8120.2,  and  the  ASD(C3I) 
memorandum  of  March  1995  requiring  compliance  with  the 
TAFIM.  Furthermore,  as  stated  earlier,  DMRD  918  applied 
to  midtier  computing. 


Final  Report 
Reference 


Deleted 
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Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  Comments 


Final  Report 
Reference 


Added 
Page  10 


Recommendation  2:  Establish  procedures  for  evaluating  and 
providing  corporate  information  processing  and  .storage 
requirements  on  a  DoD-wide  basis  rather  than  on  an  individual 
program  basis. 

Responses  Concur.  However,  we  continue  to  have  some  concerns 
about  the  centralization  implications  of  this  recommendation. 
Provision  of  corporate  information  processing  and  storage 
requirements  on  a  DoD-wide  basis  will  likely  require  further 
centralization  such  as  that  envisioned  under  the  final 
implementation  of  Defense  Management  Report  Decision  (DMRD)  918. 
However,  due  deliberation  and  consultation  among  senior 
management  within  the  Department  resulted  in  limitations  being 
placed  on  further  DMRD  918  activity.  Consequently,  any  DoD-wide 
evaluation  and  provision  of  information  processing  and  storage 
requirements  will  need  to  proceed  with  care. 

In  the  near-term,  the  implementation  of  OMB  Bulletin  96-02, 

* Consolidation  of  Agency  Data  Centers,"  provides  a  sound 
foundation  for  better  computer  capacity  planning  and  DoD-wide 
data  sharing.  Among  other  things,  the  goals  of  this  document  are 
to  reduce  the  total  number  of  DoD  data  centers,  collocate  small 
and  midtier  computing  platforms  in  larger  data  centers,  and/or 
outsource  certain  information  processing  requirements. 


Management  Control  Program:  We  do  not  agree  that  the  purported 
»gap  in  policy  for  the  acquisition  and  management  of  computers 
that  process  corporate  information"  is  a  material  management 
control  weakness,  and  Recommendation  1  and  2,  when  implemented, 
will  correct  the  weakness.  First,  the  weakness  as  described  in 
the  report  is  not  well-defined.  Secondly,  we  nonconcur  with 
Recommendation  1;  consequently,  we  do  not  believe  implementation 
of  both  recommendations  will  result  in  the  solution  of  an  ill- 
defined  problem.  Finally,  if  one  believes  that  a  part  of  the 
real  problem  is  potentially  redundant  computing  capacity,  this  is 
not  necessarily  an  example  of  waste,  fraud,  and  abuse. 
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